Stash

• 

  Stash production workspace: the governed memory release lifecycle at a glance.

• 

  Audit trail preserving provenance, decisions, promotions, reads, and rollback lineage.

• 

  Production settings for CockroachDB and AWS provider configuration.

• 

  Approved memory change with bound evidence and review status.

• 

  Behavioral evaluations with baseline comparison and provider evidence.

• 

  Memory Explorer showing active semantic memory and its release context.

• 

  CockroachDB and AWS setup with production-readiness guidance for judges.

• 

  A suspicious memory proposal quarantined before it can become retrievable.

Inspiration

AI agents increasingly rely on durable memory, but most teams still treat memory updates like ordinary application writes. A poisoned instruction, stale policy, or incorrect fact can silently become future behavior. We built Stash because durable agent memory deserves the same release discipline as production code: provenance, automated checks, behavioral tests, review, atomic promotion, lineage, and rollback.

What it does

Stash is a production release control plane for AI-agent memory. Every proposed memory change enters as a candidate with immutable provenance. Deterministic and semantic screening can quarantine suspicious content before retrieval. Legitimate changes are replayed against recorded scenarios, compared with the current baseline, and reviewed against the exact content digest and evidence.

Promotion is a serializable transaction: Stash rejects stale evidence, supersedes the previous version, activates the approved memory and its vector, advances the namespace revision, appends an audit record, and writes the outbox event atomically. Agents retrieve only active tenant-scoped memory, and Stash persists a read receipt showing exactly what influenced a response. Rollback is forward-only, preserving history instead of rewriting it.

How we built it

CockroachDB Cloud is the transactional and semantic system of record. It stores candidates, provenance, screening findings, evaluations, reviews, releases, active revisions, read receipts, audit lineage, and the transactional outbox. Memory uses VECTOR(1024) embeddings and CockroachDB Distributed Vector Indexing. Serializable transactions, bounded 40001 retries, idempotency keys, and active-version uniqueness protect promotion and rollback under concurrency. We used the ccloud CLI to verify the production cluster and index readiness, and the CockroachDB Agent Skills Repo informed schema, transaction, privilege, operational-health, and audit reviews.

Amazon Bedrock provides structured semantic-risk judgments and managed 1,024-dimensional embeddings. AWS Lambda and API Gateway run the authenticated API, behavioral sandbox, and outbox dispatcher. Amazon S3 stores encrypted, versioned, content-addressed evidence, while EventBridge distributes idempotent lifecycle events. Secrets Manager, CloudWatch, X-Ray, and Cognito support protected configuration, observability, tracing, and identity. Vercel serves the reviewer console and signed same-origin session gateway.

Challenges we ran into

The hardest problem was proving that memory state and semantic retrieval could not drift apart. A simple vector-search demo would not be enough: approval evidence can go stale, retries can duplicate promotions, and an operational row can diverge from its embedding. We addressed this with digest-bound reviews, fail-closed cloud evidence, serializable promotion, idempotent lifecycle events, tenant-scoped vector search, and persisted read receipts.

Another challenge was making the security model judgeable. Stash exposes the poisoned-memory path, evaluation receipts, promotion lineage, vector-index evidence, and forward-only rollback in one guided workspace instead of hiding the important behavior behind a polished dashboard.

Accomplishments that we're proud of

• Poisoned memory is stopped before it becomes retrievable.
• Human approval is bound to the exact candidate, baseline, policy, and evaluation evidence.
• Operational state and VECTOR(1024) embeddings move through one consistency boundary.
• Every agent read can be traced to the active revision it used.
• Rollback preserves audit history and advances the namespace revision.
• The live production path is backed by correlated CockroachDB and AWS evidence.

What we learned

We learned that trustworthy agent memory is primarily a release-engineering and database-consistency problem. Semantic relevance matters, but it must sit inside a system that can explain where memory came from, why it was approved, which version was active, what an agent read, and how to recover safely.

What's next for Stash

Next we would add policy packs for more agent frameworks, richer multi-model evaluations, organization-wide approval rules, retrieval-quality monitoring, and SDK integrations that make governed memory reads a drop-in primitive for production agents.

Try the live guided workspace at trystash.xyz, then inspect the public source and production evidence.

Built With

• agent-skills
• amazon
• amazon-bedrock
• amazon-web-services
• api-gateway
• aws-lambda
• ccloud-cli
• cloudwatch
• cockroachdb
• cockroachdb-cloud
• cognito
• distributed-vector-indexing
• eventbridge
• nextjs
• secrets-manager
• typescript
• vercel
• x-ray